3109 matches found
WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting
WordPress Hero Maps Premium plugin 2.2.1 and prior contains an unauthenticated reflected cross-site scripting vulnerability via the views/dashboard/index.php p parameter. id: CVE-2019-19134 info: name: WordPress Hero Maps Premium =2.2.2 or apply the vendor-provided patch to fix the XSS...
WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...
GP Premium <= 2.4.0 - Cross-Site Scripting
The GP Premium plugin for WordPress up to 2.4.0 is vulnerable to reflected XSS via the 'message' parameter in inc/verify.php lines 95-101, where a message passed with slactivation=false is URL-decoded and used unsanitized in addsettingserror, allowing XSS payloads to be reflected in admin notices...
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the gettemplatecontent AJAX handler, allowing unauthenticated attackers to retrieve private...
CVE-2025-24659
CVE-2025-24659 1️⃣ 组件类型 WordPress 插件 2️⃣ 组件详情 组件名称 Premium Packages – Sell Digital Products Securely 受影响版本 = 5.9.6 组件标识 wpdm-premium-packages 组件链接 https://wordpress.org/plugins/wpdm-premium-packages/ 3️⃣ OWASP 2017：TOP 10 漏洞类别 A3：注入 漏洞类型 SQL 注入 4️⃣ 前置条件 管理员 5️⃣...
CVE-2018-7848
CVE-2018-7848 受影响产品 施耐德电气 Modicon M580 版本 2.90 施耐德电气 Modicon M340 版本 3.10 施耐德电气 Modicon Premium 所有版本 施耐德电气 Modicon Quantum 所有版本 参考 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/ https://www.talosintelligence.com/vulnerabilityreports/TALOS-2018-0740 使用方法 root@kitploit: python...
CVE-2024-48392-PoC
CVE-2024-48392 漏洞利用 概述 此仓库包含针对 CVE-2024-48392 的概念验证 PoC 漏洞利用代码，该漏洞是在 Orangescrum 自托管版及高级版中发现的 XSS 漏洞。CVE ID: CVE-2024-48392...
telegram-phish-simulator
⚠️ Telegram 钓鱼模拟器 – 教育安全工具 请勿将此代码用于非法活动。 本仓库是一个专为网络安全教育、意识培养和授权实验室测试而构建的模拟程序。 📚 目录 关于 文件内容 安全实验环境搭建 如何运行 模拟攻击流程 防御指导 道德使用 许可证 🎯 关于 本项目演示了一个 Telegram 钓鱼模拟，旨在用于： 网络安全培训， 钓鱼意识练习， 防御性研究， 在隔离环境中的授权渗透测试。 它展示了攻击者如何利用虚假的“免费 Premium”优惠来收集电话号码、截获验证码并请求 2FA 密码。 本仓库并非用于实际钓鱼或账户接管。它不会连接到 Telegram 的实时 API。 📁 文件内...
owt
Currently unstable will be updated eventually. Offensive Wifi Toolkit owt created by Brennan Mccown clu3bot This tool compiles some necessary tools for wifi auditing in a unix bash script with a user friendly interface. The goal of owt is to have the smallest file size possible while still...
CVE-2026-5076
☠️ CVE-2026-5076 ARMember Premium = 7.3.1 不安全的密码重置机制 → 完全管理员账户接管 数据库中以明文存储的密码重置密钥 + SQL注入 = 完全管理员接管 📋 漏洞信息 项目| 详情 ---|--- CVE ID| CVE-2026-5076 插件| ARMember – Membership Plugin & Content Restriction 受影响版本| Premium = 7.3.1 已修补版本| 7.3.2 CVSS 评分| 9.8 严重 CWE| CWE-640: 弱密码恢复 类型| 不安全的密码重置机制 → 明文密钥存储...
CVE-2026-66598
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63340
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
EUVD-2026-62372
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-32552
A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...
Malicious code in chrome-enterprise-premium-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850bd071a15b1c20097032c5861cdfdeb970d05b4e28f65d5bcdb411fba5d10d chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on npm install and POSTs installer host metadata...
CVE-2026-73190
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...